Google Security Blog

Not everything will be rewritten in Rust. I've broken down the arguments for why this is, and why it's a good thing, elsewhere [1].

Google's recent analysis on their own experiences transitioning toward memory safety provide even more evidence that you don't need to fully transition to get strong safety benefits. They incentivized moving new code to memory safe languages, and continued working to actively assure the existing memory unsafe code they had. In practice, they found that vulnerability density in a stable codebase decays exponentially as you continue to fix bugs. So you can reap the benefits of built-in memory safety for new code while driving down latent memory unsafety in existing code to great effect. [2]

[1]: https://www.alilleybrinker.com/blog/cpp-must-become-safer/

[2]: https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html

> Only at the cost of runtime checks

And those checks are well worth paying for, enough that Rust also has them! I'm sure Rust would have even worse ergonomics if it insisted on no runtime bounds/unwrap checks. The performance cost is low enough that every systems programming language should have spatial safety. To illustrate, Google found that hardening libc++ by adding bounds checks only led to a 0.30% performance impact on their services [1]. It's not hard to imagine that a similar run-time cost affects Zig and Rust. Both languages make attempts to optimize the checks away if the operation is known-safe. Although, maybe Rust is more successful due to the borrow checker.

> and/or misusable allocator passing.

Could you clarify how allocator misuse might lead to a spatial safety violation?

[1] https://security.googleblog.com/2024/11/retrofitting-spatial-safety-to-hundreds.html

Quantum computers don't break Differential Privacy. Read the toy example at https://security.googleblog.com/2014/10/learning-statistics-with-privacy-aided.html

>Let’s say you wanted to count how many of your online friends were dogs, while respecting the maxim that, on the Internet, nobody should know you’re a dog. To do this, you could ask each friend to answer the question “Are you a dog?” in the following way. Each friend should flip a coin in secret, and answer the question truthfully if the coin came up heads; but, if the coin came up tails, that friend should always say “Yes” regardless. Then you could get a good estimate of the true count from the greater-than-half fraction of your friends that answered “Yes”. However, you still wouldn’t know which of your friends was a dog: each answer “Yes” would most likely be due to that friend’s coin flip coming up tails.

I wrote an April Fool's parody in 2021 that Google is going to get rid of authentication because they're following you around enough to know who you are anyway (modeling it after their No Captcha announcement[1]):

http://blog.tyrannyofthemouse.com/2021/04/leaked-google-initiative-no-more.html

Edit:

>I think the truth is, they just want your face.

I just realized the parody also predicted that part (emphasis added):

>>In cases where our tracking cookies and other behavioral metrics can't confidently predict who someone is, we will prompt the user for additional information, increasing the number of security checkpoints to confirm who the user really is. For example, you might need to turn on your webcam or upload your operating system's recent logs to give a fuller picture.

[1] https://security.googleblog.com/2014/12/are-you-robot-introducing-no-captcha.html

> Linearizability is just not as important as some people make it out to be.

That's my entire point. Start with strong models and weaken when you decide you need it. Thus rule out entire classes of bugs for 99% of your code and closely scrutinize the 1% with weakened guarantees to know that it works. That is kind of the entire premise behind Rust. Make it extremely visible where the dragons may exist, because you have the key to unlock that door.

Regarding memory safety, 70% of CVEs at Microsoft and in Chrome are memory safety bugs. I would say the choice of languages without memory safety is more based on legacy than some kind of insightful choice.

https://msrc-blog.microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/

https://security.googleblog.com/2022/03/whats-up-with-in-wild-exploits-plus.html

I'm not close to Zig development, but in addition to the GeneralPurposeAllocator work that a comment already links to, there is other ongoing stuff in that space, like an allocator in 64-bit that does not reuse pages (and instead keeps using new addresses in the "infinite" 64-bit space).

There are also known techniques like Type-After-Type that can avoid use-after free in C and C++ [0]. And also advances in hardware like ARM MTE [1]. Those things - and GPA, and not reusing 64-bit pages - have various tradeoffs in terms of overhead, but Zig is a developing language that has a chance to explore possibilities that C and C++ can't. So this is an interesting area to follow.

[0] https://dl.acm.org/doi/10.1145/3274694.3274705
[1] https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html